namespace ZB.MOM.WW.Secrets.Abstractions;

/// <summary>
/// The consumer-facing read seam: resolves the current plaintext of a secret by name. This is
/// the surface application code depends on to fetch secrets at runtime; every resolution is
/// audited (the access, never the value).
/// </summary>
public interface ISecretResolver
{
    /// <summary>
    /// Resolves and decrypts the current plaintext for <paramref name="name"/>.
    /// </summary>
    /// <param name="name">The secret to resolve.</param>
    /// <param name="ct">A token to cancel the operation.</param>
    /// <returns>
    /// The decrypted plaintext, or <c>null</c> if the secret is absent or tombstoned.
    /// </returns>
    Task<string?> GetAsync(SecretName name, CancellationToken ct);
}
